Kiran 
Cybersecurity researchers have uncovered the first documented malware campaign targeting Android-based car head units, exploiting a legitimate firmware update mechanism to silently install ad-fraud and proxy-botnet malware on vehicles’ infotainment systems.
Kaspersky’s Securelist team, while monitoring Android threats in June 2026, spotted an unusual sample: an app that installed like a normal user application but had no interface whatsoever.
That absence of any disguise as legitimate software suggested it wasn’t being installed with user consent. Investigation confirmed this, tracing the infection back to the DoFun head unit’s firmware and built-in updater, marking the first known case of malware distributed through a car head unit’s own update system.
BADBOX Malware Hits Car Head Units
The entry point is TWCore, a legitimate system app on DoFun head units responsible for analytics and software updates. TWCore receives instructions from an MQTT broker hosted on cardoor[.]cn, specifying which APK files to fetch.
A Boolean flag called installNotExists lets the updater install apps that were never present on the device in the first place, bypassing the check that would normally block unsolicited installs.
This delivers a three-stage payload. Stage one is JarService, a bare-bones dropper that decrypts XOR-encrypted blocks to load the next stage via Java reflection. Stage two is a loader that reports device details to a command-and-control server and receives a download link for stage three, using shifting single-byte and floating-point keys to decrypt the payload.
Stage three is the workhorse: a clicker and reverse-proxy loader that polls a C2 server every 90 minutes, reporting device fingerprints, screen resolution, model, Wi-Fi SSID, MAC address, and receiving remote commands.
Researchers cataloged nine possible commands, though attackers currently rely mainly on two: http, for arbitrary web requests, and loadlib2, which downloads and executes additional code.
The latter deploys “zhima,” a reverse-proxy module also independently spotted in TV set-top boxes by Nokia’s Deepfield Emergency Response Team, confirming that the campaign’s endgame is to build a residential proxy botnet for resale.
A thread named “mosdk-host-loader” in the stage-two loader led investigators to a related malicious app on TV set-top boxes containing a service called AdmoyuService.
Combined with network infrastructure overlaps independently confirmed by Nokia’s team, Kaspersky attributes the campaign with high confidence to MoYu Group, an actor tied to the BADBOX botnet ecosystem previously detailed by HUMAN Security researchers.
The team also found a self-registration admin panel at admin.uipoxy[.]com sharing authentication patterns with residential proxy vendors PXYEDGE and ProxyForU, reinforcing the commercial proxy-reselling motive behind the operation.
“This case underscores that any Android device with connectivity and an update channel is fair game for botnet operators head units were simply the next logical target once smartphones and set-top boxes became saturated,” said Dmitry Kalinin, the Securelist researcher who led the investigation.
Head units typically hold no data of direct value to attackers, but their SIM connectivity and always-on internet access make them ideal recruits for IoT-style botnets.
Kaspersky notified DoFun of the flaw, and the vendor says it has since fixed the distribution issue. Detection names for the malware family include HEUR:Trojan-Dropper.AndroidOS.Agent.vu, HEUR:Trojan-Downloader.AndroidOS.Agent.ov, and HEUR:Trojan-Proxy.AndroidOS.Zhima.*, among others, giving defenders concrete indicators to hunt for as MoYu Group continues expanding BADBOX-linked operations to new device categories.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
